What TLA+ can and software)

While both TLA+ and ADA/Spark might be necessary, I haven't noticed much mention of ADA/SPARK here, which kind of surprised me that they are empirically the best.